15.05.14
'Landmark' ECJ Google ruling on Data Protection Directive
On 13 May 2014, the European Court of Justice (ECJ) ruled in the case of Google Spain SL, Google Inc. v Agencia Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzalez (Case C-131/12). Mr Gonzalez had brought a claim against Google after search engine results continued to display an auction notice that had been published by a newspaper on its website in 1998. The notice was in respect of the auction of his property after Mr Gonzalez had allegedly failed to pay social security debts. The property was in fact never auctioned because the debts had been settled by Mr Gonzalez. Yet search engine results continued to retrieve the notice over 10 years later and Mr Gonzalez brought an action against Google in the Spanish courts to remove the publication. While the AEPD agreed that the results should be suppressed, the Audiencia Nacional (Spanish High Court) referred questions on the meaning of the Data Protection Directive (DPD) to the ECJ.
The DPD is concerned with the rights of data subjects to object to the processing of their personal data and to have such data corrected. The ECJ was asked to consider the scope of the Directive (including its application to non-EU data processors) and the activities that are caught by the Directive.
Google defended the action on the basis that search engines do not control the selection of the data that is retrieved by them and do not distinguish between personal data and other types of data. The ECJ did not agree that they were not caught by the DPD. The ECJ rejected this stance and indicated that a wide definition of the term ‘controller’ must apply in order to protect data subjects and that the impact of the search results must, therefore, be considered in addition to the activities carried out by Google. They confirmed that data which was ‘inadequate, irrelevant or no longer relevant or excessive’ should be removed. The decision suggests that search engine providers, such as Google, are data controllers under the DPD and will have to take greater responsibility in the future for the information that is retrieved.
Geographical scope was also considered and the Attorney General argued that, although Google was processing the data in the United States of America, it had an establishment in Spain satisfying the requirement of Article 4(1)(a) of the DPD. At paragraph 56 of the Judgment, the ECJ commented:
“…the activities of the operator of the search engine and those of its establishment situated in the Member State concerned are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed.”
The ECJ went on to suggest that a balancing exercise between the rights of the data subjects and the legitimate interests of third parties in being able to access the information may need to be carried out in some cases. The Court considered that, given it was 16 years since the first publication of the auction notice, that Mr Gonzalez was justified in seeking the removal of the adverse search results. The referring court will now need to consider whether there is any public interest in the material before Mr Gonzalez will have won the case.
The EU Justice Commissioner, Viviane Reding, was supportive of the ruling stating on her Facebook page: “The ruling confirms the need to bring today’s data protection rules from the ‘digital stone age’ into today’s modern computing world”.
To read the judgment in full, click here:
Legal Disclaimer
Articles are intended as an introduction to the topic and do not constitute legal advice.
